Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I need to set up a separate Wifi network for guests, and am looking for a decent router which can be part of the LAN but restrict access so that it can only route to the gateway/WLAN.

Are there any wifi routers which can do this out of the box? I'd rather not use customized WRT-54s, or custom hotspot software, as I do not require logon pages/password generators or any advanced functions, just static setup, but with no access to the LAN!

share|improve this question
up vote 2 down vote accepted

It is your lan's business to protect itself from your wireless router, not your wireless router's job to protect your lan.

Depending on the size of your site --

hang the AP off of an interface on your firewall

configure an isolated vlan and connect the APs to that vlan, then connect that vlan to your firewall.

Now, configure your firewall to allow that network to access the internet but not the internal network.

Lastly, if you don't want to set that up, go buy yourself a netscreen 5gt-221 with wireless built in. Later, if you decide you need more APs, you can connect those to an interface on the netscreen.

share|improve this answer
Probably a very good point. However, I am short on resources, and I haven't got any available interfaces on my firewall, making a VLAN difficult. Would a setup where everything is routed to the gateway be insecure, or difficult to achieve with standard AP firmware? – grojo Nov 6 '09 at 14:20
Setup another vlan and run tagging to the firewall, if you can. Your switch may or may not support this but the firewall almost certainly supports 802.1q vlans. – chris Nov 6 '09 at 15:30

Without knowing more details about your existing LAN, I would suggest looking into VLANs. If your existing infrastructure supports VLANs, you can purchase an Access Point that supports VLANs. Cisco, D-Link, and others have small business APs that support them. You would then configure your switching equipment to route all your wireless guest traffic through a dedicated VLAN and straight out a separate interface in your firewall or router. Configured properly, this would prevent them from ever accessing your local LAN traffic.

share|improve this answer
All good advice, but I was looking for a solution where I only had get a wifi AP, without need to change other hardware in the LAN – grojo Nov 6 '09 at 14:22
If a VLAN configuration is not possible, you can grab a wireless cable/dsl router, plus the WAN port in to your LAN, but don't connect anything to the built-in LAN switch. Create a separate IP range for the wireless/LAN interface. If the device has a stateful firewall, you could look in to only allowing port 80 and 443 through it. – Kevin Garber Nov 6 '09 at 15:09
plug the WAN port in to your LAN, not plus it. :) – Kevin Garber Nov 6 '09 at 15:10
The AP doesn't need to support vlans; the switch it's connected to should support vlans, and the firewall should support vlans. – chris Nov 6 '09 at 15:44
Would I not get problems with NAT on NAT? I have only two interfaces on my firewall, one facing WAN and one facing the LAN. The WAN interface have NAT set up (although I have several IP adresses, I use only one) – grojo Nov 8 '09 at 13:11

Let me preface this with the comment that you SHOULD NOT DO THIS

You can set the subnet of the "outside" interface on any "wireless router" that does nat to be a /30 that includes only your current router/firewall. It goes without saying that you need to make the rules on the firewall not allow traffic from the wireless router into the rest of the /24 production network.

Let's say your current firewall/router's config has as the inside interface for your production network. Set your AP's interface to be and it's outside interface netmask to be a /30 (or Now your AP will send all traffic (that isn't in the wireless network) to the firewall. Make sure the wireless router is doing NAT and it isn't acting like a bridge.

So --

router: (production network)
AP:  (outside)  (inside) -> AP's default route

Lastly, if you want to put more APs onto this "wireless network" -- set all the SSIDs to be the same, reduce the power on all the APs, set them to different channels, and turn off DHCP on all but the one connected to the firewall, and then connect the "inside" interface of each new AP to the first AP's "inside" network interfaces.

share|improve this answer
Interesting suggestion - why do you recommend not to do it? Would it be unsecure? One thing I can think of is to make sure that routing from to the rest of the LAN is disallowed. – grojo Nov 8 '09 at 9:39
It should be secure but it's an unusual and unorthodox use-case that is unlikely to be well QAed by your vendors and it relies 100% on your consumer grade router to not leak arp poisoning or netmask ignoring attacks that would allow an attack vector into your "secure" network. But, it has the virtue of being cheap and better than nothing. – chris Nov 8 '09 at 20:27
tempting, but I think I will not risk it if it is a chance (although small) that someone will try to break in, especially as the security at the AP will be limited – grojo Nov 11 '09 at 10:57

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.